201207090543 w9irf

explained decrypted filler

seed 516

Metadata

Post ID: w9irf
Title: 201207090543 → 2012-07-09 05:43 on A858's clock
Posted (UTC): 2012-07-09 09:41:44
Timezone: UTC−4 · title 05:43 against posted 09:41 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 15
Filler GUID seed: new Random(516).Next(9) ✓ verified
Run: Run 14 (seed 205,976,312) (seed)
Draw: 13 · predicted N = 15 ✓
Machine boot: 2012-07-05 08:28–12:28 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

A908A57903182B16 61A59DBAE4344C40 39B5DF4F8FF4ECD2 E49AF6596C4EBD9E 1CA74A7D31485B29 1644F89599BC8184 3FB2414158A01A24 1151231FCBA8120E 53AB9CBE4F90A6C1 D7EEF708E51ABABC 8BD3C8418ACD47DB C160C5A08D3FD2EE 7C7C229A59114279 79C19BB9A43B531C 989AFFD630E3D981 4E1B4D390C84616B A552A85D143ED509 C0D4E2BA3D811C90 41F48B8FB7FF66DF 0425D450CFC4E2AE A8B0C71FE3EA3242 F2A4BF1365A04F7D 72E24BFC94DA158A EE57E301C3AFE692 94402C8FB5486E90 7DC0C45E7B96A582 A601FD3A5B9E4055 1885A7C1934DCE29 52ECFB78DB7DCBB2 6D2038A11E430DBD 30F8C20ADC68CD76 644AA52B8738372C BBEDF68F9D89842D 2736377786581789 87B90B47C3596DB2 51A75F6768EAAC00 702DEB1BC86C552F 14C4B4D2A97D6E4F 698CBA876253A50E 2E8E8FD405C0819D 0A694AA55E974A54 E74DE6F150E1845B 501681831D8150B1 1F4F82832D379B7F CE92A3042E1FFC88 504899B0914E2120 C7FB8FF510D2826A 8378A1CF53071B78 FE11D25D805300C3 F0A8376AC14B84E1 5D85E69A820CE674 928EFAC3D7FEE894 39C3BADD6CB95398 DB6465215A87E07E 2FB588A3D37B3006 CCED86881C5749EF 410EA4C3AB0232B5 823D2352013730CB C10794A832ABA041 1B15D3C35D993EB2 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2bc2fb42-f554-29dc-a164-abda58b466d1
  2 2afc6373-4148-1e8a-bd3b-c1d2d2ab2840
  3 3a6bdde0-9db0-4b5f-8f1e-1805a08f728d
  4 ee61ec3d-4f3d-65f1-9f3d-28e05e6e7d2d
  5 1bba3391-452a-1072-826b-f3c7cd6267df
  6 7362cd1a-9d70-4b60-9ea2-94f16844146a
  7 c33da55f-a4a8-0943-9a3f-765957b75c4f
  8 1640d45f-b3c6-2ac4-b2cb-2e7b9f97ca7e
  9 6e53bedb-bb27-747b-ad39-20fa03b71630
 10 3c7150e4-d63a-46a8-b86d-f1cb261379b7
 11 f44900be-05b1-47be-a044-f9ff52d7fe87
 12 e5a91076-1b8d-2370-960c-d054ca81aa01
 13 1b7a8217-c77d-3eec-859a-43a595724939
 14 c0a7f224-92e9-8699-8b0a-b6292308edd6
 15 9d38be4a-9650-10d8-bce8-390a85c84dae

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 214614027442381. Exactly this sequence comes out of new Random(516).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 13 of Run 14 (seed 205,976,312): new Random(205976312), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 08:28–12:28).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related